Bangkok Bank Public Company Limited, New York Branch has notified customers of a data security incident that may have exposed their personal information. The incident did not originate on the Branch’s own network, but at Mercadien, P.C., a third-party firm the Branch had engaged to provide audit services. Companies that share sensitive customer data with outside auditors, vendors, and service providers have a responsibility to ensure those third parties protect that information just as carefully as the company itself would.
Bangkok Bank New York Branch’s Data Breach Investigation
According to the notice sent to affected individuals, Bangkok Bank New York Branch had provided Mercadien with various types of data in connection with the audit services Mercadien performed for the Branch, including information related to non-public personal information. Mercadien subsequently discovered a data security incident that may have affected this information and completed a third-party forensic investigation to determine the scope of the compromise, followed by a comprehensive data analysis to identify every individual impacted. Bangkok Bank has stated that it has no indication that any customer information has actually been misused as a result of the incident, but is notifying affected individuals out of an abundance of caution.
Data breaches involving third-party vendors and auditors have become increasingly common across the financial services industry. Banks and other financial institutions routinely share account and customer data with outside accounting firms, auditors, and technology providers in order to meet regulatory and compliance obligations, but each additional party that touches that data represents another potential point of failure. When an auditor or vendor is compromised, the financial institution that originally collected the data is still the one whose customers bear the consequences, even though the institution itself may have had strong security controls in place.
The specific combination of information involved in this incident, names paired with dates of birth and Social Security numbers, is particularly valuable to identity thieves because it can be used to open new financial accounts, apply for credit, or file fraudulent tax returns in a victim’s name. Unlike a stolen credit card number, which can simply be canceled and reissued, a compromised Social Security number cannot be changed, meaning affected individuals may need to remain vigilant for fraudulent activity for years after a breach like this one occurs.
Financial institutions are generally required under state and federal law to notify affected individuals and applicable regulators within a reasonable time after discovering that customer data has been compromised. The exact timeline for when Bangkok Bank New York Branch first learned of the incident and how long the investigation took to complete has not been made public in the notification letter, which is not unusual for third-party vendor breaches. Because the forensic review and data analysis needed to determine exactly whose information was affected can take weeks or months to complete, the gap between when an incident is initially discovered and when affected individuals actually receive notice is often longer than consumers expect. Individuals impacted by this incident should understand that this delay is common in vendor-related data security incidents and does not necessarily indicate any additional wrongdoing on the part of the notifying company.
When Did This Breach Occur?
Bangkok Bank New York Branch’s notification letter does not publicly specify the exact date on which the incident occurred or was discovered by Mercadien. The letter indicates that Mercadien identified the incident, completed a third-party investigation to confirm the scope of the compromise, and then conducted a comprehensive data analysis before notifying the Branch, which in turn notified affected customers. As is common with third-party vendor incidents, a precise breach date has not been publicly disclosed as of this notice.
What Information Was Breached?
According to the notice, the information that could have been compromised includes each affected individual’s name, address, date of birth, and Social Security number. Bangkok Bank New York Branch has stated it has no evidence at this time that any personal information has actually been misused, but is notifying customers so they can take steps to monitor their information.
What You Can Do
Bangkok Bank New York Branch is offering affected individuals free access to credit monitoring through IDX for 24 months. Individuals who received a notification letter can enroll using the unique code provided in their letter. In addition, affected individuals should consider taking the following steps:
- Enroll in the complimentary IDX credit monitoring service before the enrollment deadline stated in your letter
- Regularly review bank and credit card statements for unauthorized transactions
- Consider placing a fraud alert or security freeze with Equifax, Experian, and TransUnion
- Order a free annual credit report at annualcreditreport.com to check for suspicious activity
- Consider obtaining an Identity Protection PIN from the IRS to help prevent fraudulent tax filings
File a Data Breach Lawsuit Against Bangkok Bank New York Branch
If you received a data breach notification letter from Bangkok Bank New York Branch, you may be entitled to compensation. Companies that collect and share sensitive customer information, including with third-party vendors and auditors, have a legal obligation to keep that information secure.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
